Description
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This issue affects FreeRDP based RDP Server implementations. RDP clients are not affected. The vulnerability is patched in FreeRDP 2.7.0. There are currently no known workarounds.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| FreeRDP | FreeRDP | < 2.7.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | freerdp2 | 2.7.0+dfsg1-1 | — |
| Debian 11 | freerdp2 | 2.3.0+dfsg1-2+deb11u3 | DLA-4070-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | freerdp2 | 2.6.1+dfsg1-3ubuntu1 | USN-5461-1 |
| Ubuntu 20.04 LTS | freerdp2 | 2.2.0+dfsg1-0ubuntu0.20.04.3 | USN-5461-1 |
| Ubuntu 18.04 LTS | freerdp | No fix yet | — |
| Ubuntu 18.04 LTS | freerdp2 | 2.2.0+dfsg1-0ubuntu0.18.04.3 | USN-5461-1 |
| Ubuntu 16.04 LTS | freerdp | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | freerdp | 2.4.0-150400.3.3.1 | SUSE-SU-2022:2354-1 |
| SLES 15 SP3 | freerdp | 2.1.2-150200.15.15.1 | SUSE-SU-2022:2353-1 |
| SLES 12 SP5 | freerdp | 2.1.2-12.23.1 | SUSE-SU-2022:2352-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | freerdp2 | 2.11.2-3.1 | openSUSE-SU-2024:13504-1 |
| openSUSE Leap 15.4 | freerdp | 2.4.0-150400.3.3.1 | SUSE-SU-2022:2354-1 |
| openSUSE Leap 15.3 | freerdp | 2.1.2-150200.15.15.1 | SUSE-SU-2022:2353-1 |
Advisories 6
- USN-5461-1 freerdp2 vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DLA-4070-1 freerdp2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2022:2353-1 Security update for freerdp SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:2352-1 Security update for freerdp SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13504-1 freerdp-2.11.2-3.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:2354-1 Security update for freerdp SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://github.com/FreeRDP/FreeRDP/releases/tag/2.7.0
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6x5p-gp49-3jhh
- https://github.com/FreeRDP/FreeRDP/pull/7750
- https://gitlab.gnome.org/GNOME/gnome-remote-desktop/-/issues/95
- FEDORA-2022-dc48a89918 vendor-advisory
- FEDORA-2022-a3e03a200b vendor-advisory
- FEDORA-2022-b0a47f8060 vendor-advisory
- GLSA-202210-24 vendor-advisory